- Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Do not generate debug packages Resolves: RHEL-70582 - Rebuild Resolves: RHEL-70582 - Add an rpminspect.yaml file to turn-off debuginfo testing Resolves: RHEL-70582 - remove strip of realtime-entsk and generate debuginfo - ensure all files have valid SPDX license identifiers - remove Red Hat Makefile targets and specfile - Makefile cleanups and added .gitignore - drop the 'v' in the version string for the tarball - Makefile: add options for passing annocheck - Bump version to 2.5 Resolves: RHEL-30179 - Rebase to upstream rteval-3.10 Resolves: RHEL-82914, RHEL-111000, RHEL-114928 - Make timerlat the default measurement module - Make the default interval 100us Resolves: RHEL-97540 - Fix syntax warning when using python >=3.12 Resolves: RHEL-97825 - Make the default interval for timerlat in rteval 1100us - Make cyclictest the default measurement module for rteval Resolves: RHEL-78394 - Fix missing system statistics Resolves: RHEL-70166 - Rebase to upstream rteval-v3.9 Resolves: RHEL-63519 - Update the kcompile kernel to linux-6.12-rc4 Resolves: RHEL-63621 - Collect tuned state in sysinfo Resolves: RHEL-33303 - Add functionality to allow user to execute cpupower tool to set idle state depth while running rteval. - Disable latency trick by using --default-system option with cyclictest when setting idle state depth. Resolves: RHEL-37645 - Prevent using cyclictest and timerlat and the same time - Add a --noload option - Switch to autosetup, picking up the updates that should have been in 3.8-4 Resolves: RHEL-35506 Resolves: RHEL-50323 - Rebuid in a side tag in order to sync with rteval Resolves: RHEL-86701 - Changed the kernel version to 6.17.7 - changed the rteval-loads number scheme to reflect the kernel version Resolves: RHEL-86701 - Rebuild to go through gating Resolves: RHEL-67848 - Upgrade the kernel to linux-6.12-rc4 Resolves: RHEL-63614 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615